CVE-2024-57881
Last modified
CVE-2024-57881 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases, such as when freeing the highest pageblock in the last memory section, this could result with CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and __section_mem_map_addr() dereferencing that NULL pointer. Let's fix it, and avoid doing a pfn_to_page() call for the first iteration, where we already have the page. So far this was found by code inspection, but let's just CC stable as the fix is easy.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases, such as when freeing the highest pageblock in the last memory section, this could result with CONFIG_SPARSEMEM && !CONFIG_SPARSEMEM_EXTREME in __pfn_to_section() returning NULL and and __section_mem_map_addr() dereferencing that NULL pointer. Let's fix it, and avoid doing a pfn_to_page() call for the first iteration, where we already have the page. So far this was found by code inspection, but let's just CC stable as the fix is easy.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | >= 6.10, < 6.12.7 | — |
| Linux | Linux Kernel | 6.13 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-57881?
How severe is CVE-2024-57881?
How do I fix CVE-2024-57881?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-57876In the Linux kernel, the following vulnerability has been re…7
- CVE-2024-57877In the Linux kernel, the following vulnerability has been re…6.1
- CVE-2024-57878In the Linux kernel, the following vulnerability has been re…6.1
- CVE-2024-57879In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-5788The Silesia theme for WordPress is vulnerable to Stored Cros…6.4
- CVE-2024-57880In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57882In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57883In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57884In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57885In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57886In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-57887In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2024-57881?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST